topic Strange NMAP behavior in Network Access Control

Strange NMAP behavior

Y C — Fri, 02 Aug 2019 22:12:44 GMT

We recently upgraded from 1.3 (no nmap probe option available) to 2.1 (defaults to policy nodes having nmap probe enabled).

Long story short - it's profiled a bunch of our devices improperly as cisco-router. Xerox & Ricoh printers, some apple devices, etc. Seems random. Apparently it gathered info that the device is a Cisco 3925 running this version IOS, or a 6506 running that version IOS...

How exactly does NMAP determine OS version? The probe description mentions it looks for open ports and OS version. Surely it relies on more then just open ports to determine a specific version.

operating-system	Cisco 6506 router (IOS 12.2)
operating-system-result	Cisco 6506 router (IOS 12.2)

operating-system	Cisco 2811 router (IOS 12.2 - 12.4) (accuracy 95%)
operating-system-result	Cisco 2811 router (IOS 12.2 - 12.4) (accuracy 95%)

Re: Strange NMAP behavior

Mark Elsen — Sat, 03 Aug 2019 09:00:15 GMT

https://www.comparitech.com/net-admin/the-definitive-guide-to-nmap/#OS_Scanning

Re: Strange NMAP behavior

Y C — Sat, 03 Aug 2019 10:34:08 GMT

Well, I guess what I should say is... regardless of what it uses, if it's this inaccurate what's the point? And the idea how it favors Cisco products is amusing. It's forgivable if it recognizes an ipad as an iphone... but a printer as a 6506? Really?

Re: Strange NMAP behavior

Surendra — Sat, 03 Aug 2019 14:30:59 GMT

If not enough ports are open, there is something called an aggressive OS lookup that is done causing the misinterpretation of the operating system. ISE uses the operating system guess from nmap.org. It is an open source resource for nmap implementation.

Re: Strange NMAP behavior

Y C — Mon, 05 Aug 2019 15:17:44 GMT

operating-system	Cisco Nexus 7000 switch (NX-OS 4.2.6) (accuracy 99%)
operating-system-result	Cisco Nexus 7000 switch (NX-OS 4.2.6) (accuracy 99%)

That's an apple device - so it thinks it's wild guess was 99% accurate.

Sounds like turning it off was the right thing to do. It's a surprise this is enabled by default if it's known wild guesses like this can happen.